James Gourrah, chair of the Institute of Internal Auditors SA (IIA), says Steinhoff, VBS Mutual Bank and now Tongaat won't be the last private sector corporate governance scandals to rock SA."Our prediction earlier this year was that there'd be much more to come," he says.This was based on a survey showing an increase in the number of internal auditors being victimised and intimidated by company executives to sweep inconvenient findings under the carpet.One in five internal auditors in the private and public sectors say they would fear for their lives if they exposed questionable activities as their profession has become increasingly dangerous.Gourrah, who was head of internal auditing at Capitec for 13 years, says this is a dead giveaway."Signs of victimisation and intimidation of internal auditors are indications of a toxic culture in an organisation."Last week's announcement that Tongaat is going after former executives, including former CEO Peter Staude, came soon after the release of the IIA's latest corporate governance index, which revealed that 43% of auditing executives believe their organisations don't take ethics seriously.He says the index raises disturbing questions about the independence and effectiveness of internal auditors.They should have the power to report directly to the chair of the audit committee and/or the board if they feel their independence is being compromised by management, but too often they don't.He concedes that the system is not working."Things are going wrong."Why?"We need to look at whether internal auditors have the necessary competence, not only to do the work but to challenge management."Internal auditors in SA have "a long way to go in terms of competence".Compared with a country like Australia, where companies employ fewer people for internal assurance functions than their South African counterparts but have higher levels of corporate governance, "SA is lagging". But it's not only about technical competence, he says. It's about being able to challenge "the culture". And this is becoming more difficult"There are many grey areas where internal auditors don't feel they can have the tough conversations with management."This is often because they're too junior."Very often the head of internal audit is not given the stature inside the company that the position deserves so that he can engage with executives at that level."This is either deliberate or because the value and role of internal auditing is not understood."They appoint internal auditors because they need to." It's a box-ticking exercise."They're not necessarily going to raise their profile to the level where they can challenge the executive sufficiently."It's hard not to be cynical about the reasons, he says. "There are pockets of unethical leadership. We do have a governance challenge in SA."Recent high-profile scandals have begun to concentrate minds, not because of a sudden belief in corporate governance but "because they see the consequences of not having ethical leadership. The threat of greater scrutiny if things go wrong. Because then people are going to demand accountability."Gourrah says Steinhoff, VBS and Tongaat have corrected the perception that corruption is mostly confined to the public sector."They have given us a clearer indication that corruption is as much prevalent in the private sector and it was underplayed."In both public and private sectors, boards have failed to protect internal auditors from executives with something to hide.The audit committees to which they report are not sufficiently independent."As a structure of the board they need to do much more, play a much stronger role in terms of protecting the audit from executive interference."The directors who serve on the audit committees often don't have the necessary skills, he says, adding that this is "more in the public than the private sector".Another reason corporate malfeasance goes undetected is that internal auditors and audit committees spend so much time focusing on the numbers that they ignore broader governance and other ethical issues."If you're not looking at the triple bottom line then you're missing the other elements of corporate governance."The use of external auditors to do the job of internal auditors, which they're neither trained nor qualified for, has also had negative consequences for corporate governance.Tongaat used external auditor KPMG to do its internal audit.Gourrah explains that internal audit is a risk-based discipline that reaches across the entire organisation. External auditors look purely at financials."They're not trained to spot symptoms of things going wrong somewhere else in the organisation, which is where an internal audit focus should be."That is why these symptoms are being missed, leading to corporate failures and wealth destruction.He says CEOs and management have become too strong and boards too weak to challenge them."This is why functions like the internal audit that are supposed to be independent are not. Ultimately, boards need to challenge management. If the board is weak it becomes purely the rubber stamp for management."This is not just about skills and ability but the willingness to think independently."You can have a board with the most qualified people but they don't sufficiently challenge what management puts in front of them."It's important that you have boards that don't have a majority of people with a vested interest."He says the "culture of deference" which prevents CEOs and management being properly challenged is "very prevalent".He defends the King 4 code of corporate governance, which has been blamed for not doing more to prevent corporate scandals.The real problem is an "absence of ethical leadership", he says. "You have a robust code but you pay lip service to it."Law enforcement is the other essential ingredient of good corporate governance."While it takes too long to demonstrate accountability, so that individuals are seen to be held to account, corporate governance will not improve."As long as we see a lack of accountability it's going to be very difficult to change the situation," says Gourrah."We need to see more timely consequences, and they need to be real consequences."..